Accessing kernel objects in other sessions part 2

Author: daNIL

3 Feb

In part 1 I showed how to create and open objects in Terminal Server Sessions. However, these are not all of the possible places where you can place objects via documented kernel32.dll functions.

If we look into Winobj again, we notice, that every BaseNamedObjects directory has a subdirectory named Restricted. To be honest, I do not know why it’s created; it’s security allows object creation for LocalSystem and RESTRICTED special user (in windows 2000, Everyone can also create objects in it). So, we can use it as prefix for object creation, for example, Restricted\MyAppEvent:

Of course, you can still use Global, Local, or Session links for accessing objects in Restricted directory, e.g. Global\Restricted\Objname, Session\6\Restricted\Objname. You can always create objects in Global\Restricted directory, while may fail creating objects in session’s Restricted directory.

What if you will use Session link, but do not add the session number to it (like Session\MyAppEvent)? It is allowed, and you’ll have your object created into the \Sessions\BNOLINKS directory:

So if you want to hide your object, but still share it with someone else, you can use it.

Download new SessionObjects version 1.1: it creates objects in all possible places.

Session Objects 1.1 (1220 downloads)

Please consider donating something (even a small amount is ok) to support this site and my work:

Filed under: Delphi, General, Programming

2 Responses for "Accessing kernel objects in other sessions part 2"

Cd-MaN February 9th, 2009 at 10:31 1
> So if you want to hide your object, but still share it with someone else, you can use it.
If I understand correctly, this is “security by obscurity”? Ie. you are creating the object in an unexpected location, but if someone else did know the location, could still access it? Isn’t this equivalent with appending an arbitrary suffix to your object which is know to both parties? (Ie, instead of MyAppEvent you would create MyAppEvent.31337)
daNIL February 9th, 2009 at 11:07 2
Yes, you’re correct. You can treat the objects and prefixes just like files and directories. Unfortunately, win32 api doesn’t provide a way for enumerating them, so it doesn’t make sense if you would modify your object name, or move it into other directory. I think the most useful info is that you can create the objects with the same name on different session, and access them from any other session.